CVE-2026-25731

HIGH

calibre < 9.2.0 - Remote Code Execution via Templite Template Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-25731. PoCs published by XiaomingX, dxlerYT.

AI-analyzed exploit summary The repository provides a functional PoC for CVE-2026-25731, demonstrating a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite engine. The exploit leverages unsafe use of `compile()` and `eval()` functions, allowing arbitrary code execution via malicious template files.

Description

calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite templating engine allows arbitrary code execution when a user converts an ebook using a malicious custom template file via the --template-html or --template-html-index command-line options. This vulnerability is fixed in 9.2.0.

Exploits (2)

github WORKING POC 10 stars
by XiaomingX · pythonpoc
https://github.com/XiaomingX/data-cve-poc-py-v1/tree/main/2026/CVE-2026-25731

The repository provides a functional PoC for CVE-2026-25731, demonstrating a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite engine. The exploit leverages unsafe use of `compile()` and `eval()` functions, allowing arbitrary code execution via malicious template files.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Calibre (Templite engine)
No auth needed
Prerequisites: User-supplied malicious template file · Access to `ebook-convert` command-line tool
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 3 stars
by dxlerYT · poc
https://github.com/dxlerYT/CVE-2026-25731

This repository contains a working proof-of-concept for CVE-2026-25731, demonstrating a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite engine. The exploit allows arbitrary code execution via malicious template files used during ebook conversion.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: calibre <= 9.1.0
No auth needed
Prerequisites: Access to a system with Calibre installed · Ability to supply a malicious template file via command-line options
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 7.8
EPSS 0.0027
EPSS Percentile 18.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-1336
Status published
Products (1)
calibre-ebook/calibre < 9.2.0
Published Feb 06, 2026
Tracked Since Feb 18, 2026